ASP.NET Core 2.0 Authentication Cookie not set
I followed this article (https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?tabs=aspnetcore2x) of Microsoft to migrate my Authentication Procedure in my .NET Core 2.0 MVC Application.
Startup.cs (ConfigureServices)
services.AddIdentity<ApplicationUser, IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders();
services.AddAuthentication("MyCookieAuthenticationScheme")
.AddCookie("MyCookieAuthenticationScheme", options => {
options.AccessDeniedPath = "/Account/Forbidden/";
options.LoginPath = "/Account/Login/";
});
Startup.cs (Configure)
app.UseAuthentication();
AccountController.cs
List<Claim> claims = new List<Claim> {
new Claim(ClaimTypes.Name, "testUser"),
new Claim(ClaimTypes.Email, model.Email),
//new Claim("ID", user.ID.ToString(), ClaimValueTypes.Integer),
new Claim(ClaimTypes.Role, "Admin")
};
ClaimsIdentity identity = new ClaimsIdentity(claims, "MyCookieAuthenticationScheme");
ClaimsPrincipal principal = new ClaimsPrincipal(identity);
await HttpContext.SignInAsync("MyCookieAuthenticationScheme", principal, new AuthenticationProperties
{
IsPersistent = false
});
Unfortunately my .NET Cookie is never set. That means User.Identity.IsAuthenticated is always false. I tried many cookie options like changing Cookie.SameSite or Cookie.SecurePolicy to all possible values.
I work with Visual Studio 2017, localhost over https, Chrome 61.
I think you should provide login process using by Identity's UserManager class instead of HttpContext.SignInAsync. Inject IUserManager to your controller constructor, and use it to login.
AccountController: Controller
{
private readonly SignInManager<ApplicationUser> _signInManager;
public AccountController(SignInManager<ApplicationUser> singInManager)
{
_signInManager = signInManager;
}
public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null)
{
var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
...
}
}
You can modify Identity's cookie settings in your Startup.cs. Take a glance:
https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity
Assuming that you are serving your application on localhost , it seems that the Chrome browser does not set the cookies for IPs or intranet hostnames like localhost . You can serve your application from IIS and use a binding with a valid host name.
When upgrading our site's authentication system for .NET Core 2.0, I had to update our controller method to use the AuthenticationHttpContextExtensions.SignInAsync() method instead of the old HttpContext.SignInAsync() .
Example:
public async Task ClaimsLogin() {
// Claims identity creation here...
ClaimsPrincipal principal = new ClaimsPrincipal(identity);
await Task.FromResult(
AuthenticationHttpContextExtensions.SignInAsync(
this.httpContextAccessor.HttpContext,
"NameOfYourCookieHere",
userPrincipal,
new AuthenticationProperties()
{
ExpiresUtc = DateTime.UtcNow.AddMinutes(2880),
IsPersistent = false,
AllowRefresh = false
}));
}
Hopefully this helps someone!
链接地址: http://www.djcxy.com/p/90192.html